Hi, The IP 107.22.141.78 has just been banned by Fail2Ban after 4 attempts against apache-dosevasive. Here are more information about 107.22.141.78: # # Query terms are ambiguous. The query is assumed to be: # "n 107.22.141.78" # # Use "?" to get help. # # # The following results may also be obtained via: # http://whois.arin.net/rest/nets;q=107.22.141.78?showDetails=true&showARIN=false&ext=netref2 # NetRange: 107.20.0.0 - 107.23.255.255 CIDR: 107.20.0.0/14 OriginAS: NetName: AMAZON-EC2-8 NetHandle: NET-107-20-0-0-1 Parent: NET-107-0-0-0-0 NetType: Direct Assignment Comment: The activity you have detected originates from a dynamic hosting environment. Comment: For fastest response, please submit abuse reports at http://aws-portal.amazon.com/gp/aws/html-forms-controller/contactus/AWSAbuse Comment: For more information regarding EC2 see: Comment: http://ec2.amazonaws.com/ Comment: All reports MUST include: Comment: * src IP Comment: * dest IP (your IP) Comment: * dest port Comment: * Accurate date/timestamp and timezone of activity Comment: * Intensity/frequency (short log extracts) Comment: * Your contact details (phone and email) Without these we will be unable to identify the correct owner of the IP address at that point in time. RegDate: 2011-05-03 Updated: 2012-03-02 Ref: http://whois.arin.net/rest/net/NET-107-20-0-0-1 OrgName: Amazon.com, Inc. OrgId: AMAZO-4 Address: Amazon Web Services, Elastic Compute Cloud, EC2 Address: 1200 12th Avenue South City: Seattle StateProv: WA PostalCode: 98144 Country: US RegDate: 2005-09-29 Updated: 2009-06-02 Comment: For details of this service please see Comment: http://ec2.amazonaws.com/ Ref: http://whois.arin.net/rest/org/AMAZO-4 OrgTechHandle: ANO24-ARIN OrgTechName: Amazon EC2 Network Operations OrgTechPhone: +1-206-266-4064 OrgTechEmail: aes-noc@amazon.com OrgTechRef: http://whois.arin.net/rest/poc/ANO24-ARIN OrgAbuseHandle: AEA8-ARIN OrgAbuseName: Amazon EC2 Abuse OrgAbusePhone: +1-206-266-4064 OrgAbuseEmail: ec2-abuse@amazon.com OrgAbuseRef: http://whois.arin.net/rest/poc/AEA8-ARIN # # ARIN WHOIS data and services are subject to the Terms of Use # available at: https://www.arin.net/whois_tou.html # Lines containing IP:107.22.141.78 in /var/log/apache*/*error.log /var/log/apache2/medisign.gr_error.log:[Thu Mar 29 16:26:27 2012] [error] [client 107.22.141.78] client denied by server configuration: /var/www/signportal/common/show_image/, referer: http://www.medisign.gr/ /var/log/apache2/medisign.gr_error.log:[Thu Mar 29 16:26:27 2012] [error] [client 107.22.141.78] client denied by server configuration: /var/www/signportal/common/show_image/, referer: http://www.medisign.gr/ /var/log/apache2/medisign.gr_error.log:[Thu Mar 29 20:33:06 2012] [error] [client 107.22.141.78] client denied by server configuration: /var/www/signportal/common/show_image/, referer: http://www.medisign.gr/ /var/log/apache2/medisign.gr_error.log:[Thu Mar 29 20:33:06 2012] [error] [client 107.22.141.78] client denied by server configuration: /var/www/signportal/common/show_image/, referer: http://www.medisign.gr/ /var/log/apache2/medisign.gr_error.log:[Thu Mar 29 20:33:47 2012] [error] [client 107.22.141.78] client denied by server configuration: /var/www/signportal/common/show_image/, referer: http://www.medisign.gr/ /var/log/apache2/medisign.gr_error.log:[Thu Mar 29 20:33:47 2012] [error] [client 107.22.141.78] client denied by server configuration: /var/www/signportal/common/show_image/, referer: http://www.medisign.gr/ Regards, Fail2Ban